@incodetech/core 2.4.0-rc.4 → 2.4.1-agentic

package/dist/{setup-BvKrAlOo.esm.js → setup-CDAKwTr7.esm.js}

@@ -1,16 +1,16 @@
-import { P as setWasmIntegrityObserver, _ as setWasmDiagnosticsHandler, w as resolveWasmConfig, y as DEFAULT_WASM_VERSION } from "./wasmWebClient-BjZw_7OB.esm.js";
-import { a as setWasmOnDeviceMode, d as drainWasmDiagnostics, f as getWasmDiagnosticsMode, n as getWarmupFacts, p as rearmWasmDiagnostics, s as warmupWasm } from "./warmup-BElYWRh7.esm.js";
-import { t as WasmUtilProvider } from "./WasmUtilProvider-DtJuBdt-.esm.js";
-import { S as setAnalyticsBatcher, b as getAnalyticsBatcher, c as resetExperimentAssignments, v as createAnalyticsBatchingService, x as resetAnalyticsBatcher } from "./events-Du2A4-Qr.esm.js";
-import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, s as setHttpRequestObserver, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
-import { S as noteTestingSignals, d as categoryForEndpoint, f as getStoredHttpConfig, h as upgradeToWasmHttpClient$1, m as resetHttpClientState, n as initializeTrueSightDiagnostics, o as resetTrueSight, p as installFreshHttpClient, s as setTrueSightExternalDrain, t as finalizeTrueSight, u as trueSightLog } from "./trueSightService-BAvhAU7T.esm.js";
-import { a as resetSessionInit, b as BrowserEnvironmentProvider, c as setClientIpLookupEnabled, d as registerFlowPreloader, f as resetStandaloneFlowPolicy, i as initializeSession, m as setStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as resolveStandaloneFlowPolicy, s as setClientHostingApp, x as fingerprintSignalsReporter } from "./sessionInitializer-c3CChZts.esm.js";
-import { t as resolveLocalStorage } from "./safeStorage-UxDrnjwa.esm.js";
+import { F as setWasmIntegrityObserver, T as resolveWasmConfig, b as DEFAULT_WASM_VERSION, g as setWasmStartGate, v as setWasmDiagnosticsHandler } from "./wasmWebClient-DTj9auyA.esm.js";
+import { a as setWasmOnDeviceMode, f as drainWasmDiagnostics, i as isWasmReady, m as rearmWasmDiagnostics, n as getWarmupFacts, p as getWasmDiagnosticsMode, r as getWasmStatus, s as warmupWasm } from "./warmup-BkfxQZsC.esm.js";
+import { t as WasmUtilProvider } from "./WasmUtilProvider-GTkoJyFY.esm.js";
+import { S as setAnalyticsBatcher, b as getAnalyticsBatcher, c as resetExperimentAssignments, v as createAnalyticsBatchingService, x as resetAnalyticsBatcher } from "./events-CQteqXfy.esm.js";
+import { a as resetApi, i as isApiConfigured, n as getApi, r as getToken, s as setHttpRequestObserver, t as api, u as endpoints } from "./api-BO8JA7Pf.esm.js";
+import { S as noteTestingSignals, d as categoryForEndpoint, f as getStoredHttpConfig, h as upgradeToWasmHttpClient$1, m as resetHttpClientState, n as initializeTrueSightDiagnostics, o as resetTrueSight, p as installFreshHttpClient, s as setTrueSightExternalDrain, t as finalizeTrueSight, u as trueSightLog } from "./trueSightService-BujtUIW6.esm.js";
+import { S as fingerprintSignalsReporter, a as resetSessionInit, c as setClientIpLookupEnabled, g as setStandaloneFlowPolicy, h as resolveStandaloneFlowPolicy, i as initializeSession, l as setClientWasmConfig, m as resetStandaloneFlowPolicy, o as setClientFingerprintEnabled, p as registerFlowPreloader, s as setClientHostingApp, u as setClientWasmDisabled, x as BrowserEnvironmentProvider } from "./sessionInitializer-CWFT4dfw.esm.js";
 import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
-import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-DCD0I_XZ.esm.js";
-import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-BEvexnKC.esm.js";
-import { a as resetTRI, n as initializeTRI, o as resetTRIProviderInstance } from "./tri-xzRLIIMN.esm.js";
-import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-COMEf-WP.esm.js";
+import { t as resolveLocalStorage } from "./safeStorage-UxDrnjwa.esm.js";
+import { C as resetFeatureManagement, D as applyEnvironment, O as getEnvironment, S as optOutFeatureManagement, b as initializeFeatureManagement, c as resetResolvedExperiments, k as resetEnvironment, v as getIsFeatureManagementLocked, w as resetFeatureManagementProviderInstance } from "./feature-management-DjAG5lsJ.esm.js";
+import { r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-BpMz-hTP.esm.js";
+import { i as isTRIStarted, o as readTRIFpSignals, r as initializeTRI, s as resetSdkOwnedTRI, t as addTRIFpSignals } from "./tri-BajQnjbf.esm.js";
+import { i as resetDashboardFlowCache, r as preloadDashboardFlow } from "./flowServices-g2tVWsJl.esm.js";
 //#region ../infra/src/wasm/wasmRuntimeProfile.ts
 /**
 * The WASM facts TrueSight reports as `session.webProfile.wasm`
@@ -496,6 +496,9 @@ async function setup(options) {
 	const shouldPreloadFlow = options.flow !== false && flowOptions.preload === true;
 	setStandaloneFlowPolicy(standaloneFlowPolicy);
 	registerFlowPreloader(preloadDashboardFlow);
+	setWasmStartGate(async () => {
+		await readTRIFpSignals();
+	});
 	if (options.ipLookup !== void 0) setClientIpLookupEnabled(options.ipLookup);
 	if (options.deviceWallet?.googleSignedRequests !== void 0) setGoogleWalletSignedRequests(options.deviceWallet.googleSignedRequests);
 	if (options.hostingApp !== void 0) setClientHostingApp(options.hostingApp);
@@ -545,6 +548,12 @@ async function setup(options) {
 		trueSightLog("severe", "http", "other", `http client install failed error=${String(error)}`);
 		throw error;
 	}
+	if (options.wasm === false) setClientWasmDisabled(true);
+	else if (effectiveWasm) setClientWasmDisabled(false);
+	if (effectiveWasm) setWasmConfig({
+		...effectiveWasm,
+		pipelines: effectiveWasm.pipelines ? [...effectiveWasm.pipelines] : void 0
+	});
 	if (options.token && isApiConfigured()) {
 		const sessionOptions = { token: options.token };
 		if (shouldPreloadFlow) sessionOptions.preloadFlow = true;
@@ -557,10 +566,6 @@ async function setup(options) {
 	configured = true;
 	applyEnvironment(options.environment);
 	if (effectiveWasm) {
-		wasmConfig = {
-			...effectiveWasm,
-			pipelines: effectiveWasm.pipelines ? [...effectiveWasm.pipelines] : void 0
-		};
 		await warmupWasm(effectiveWasm);
 		await (await WasmUtilProvider.getInstance()).initialize({
 			...effectiveWasm,
@@ -584,7 +589,13 @@ async function setup(options) {
 		if (featureManagementSetupOptions.awaitInitialization === true) await featureManagementReady;
 	}
 	else if (options.featureManagement !== void 0) console.error("[FeatureManagement] Feature management is locked after the first setup() call and cannot be changed (re-enabled, disabled, or reconfigured). Ignoring this change. Call reset() before changing it.");
-	if (options.tri) await initializeTRI(options.tri, { sessionToken: options.token });
+	if (options.tri) {
+		await initializeTRI(options.tri, {
+			sessionToken: options.token,
+			fpSignalsFromSdk: isWasmReady() || getWasmStatus().isLoading
+		});
+		if (isTRIStarted()) fingerprintSignalsReporter.forwardTo(addTRIFpSignals);
+	}
 }
 /**
 * Sets the WASM configuration without performing warmup.
@@ -594,6 +605,7 @@ async function setup(options) {
 */
 function setWasmConfig(config) {
 	wasmConfig = config;
+	setClientWasmConfig(resolveWasmConfig(config));
 }
 /**
 * Initializes WasmUtilProvider with the stored WASM configuration.
@@ -690,11 +702,12 @@ function reset() {
 	resetHttpClientState();
 	setWasmIntegrityObserver(null);
 	setWasmDiagnosticsHandler(null);
-	resetTRI();
+	resetSdkOwnedTRI();
 	configured = false;
 	wasmConfig = void 0;
+	setClientWasmConfig(void 0);
+	setClientWasmDisabled(false);
 	WasmUtilProvider.resetInstance();
-	resetTRIProviderInstance();
 	resetFeatureManagement();
 	resetFeatureManagementProviderInstance();
 	resetEnvironment();

package/dist/{setup-YPKTUCY5.d.ts → setup-D9qt8YVU.d.ts}

@@ -1,5 +1,5 @@
 import { c as WasmPipeline, i as WasmModuleConfig, n as WasmModelsConfig, t as WarmupConfig } from "./warmup-BO57syF6.js";
-import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-BKOWUhxG.js";
+import { s as TransactionalRiskIntelligenceSetupConfig } from "./index-DEfwds5y.js";
 import { c as FeatureManagementRedactedUserInfo } from "./IFeatureManagementCapability-De8wpbGh.js";
 //#region src/internal/environment/environment.d.ts
 /**
@@ -192,7 +192,7 @@ type SetupOptions = {
    * collection off (`sbc(false)`) once WASM is ready.
    *
    * It does **not** suppress the rest of native fingerprint collection:
-   * against the pinned `v2.14.50-post1` runtime, WASM starts collecting during
+   * against the pinned runtime (`v2.14.49-post1` and later), WASM starts collecting during
    * initialization regardless of this flag, and the full fingerprint bucket is
    * serialized into the metadata bundle.
    *

package/dist/signature.esm.js

@@ -1,3 +1,3 @@
-import { t as signatureMachine } from "./signatureStateMachine-C-nUq_oq.esm.js";
-import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-f_dPAGXn.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-_1c1vSid.esm.js";
+import { n as createSignatureManagerFromActor, t as createSignatureManager } from "./signatureManager-BeEVCcsC.esm.js";
 export { createSignatureManager, createSignatureManagerFromActor, signatureMachine };

package/dist/{signatureManager-f_dPAGXn.esm.js → signatureManager-BeEVCcsC.esm.js}

@@ -1,7 +1,7 @@
-import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-Du2A4-Qr.esm.js";
+import { n as eventModuleNames, o as createManagerInstrumentation } from "./events-CQteqXfy.esm.js";
 import { t as topLevelStateName } from "./topLevelStateName-B5i2avbh.esm.js";
 import { s as createActor, u as createManager } from "./xstate.esm-DSajW7CJ.esm.js";
-import { t as signatureMachine } from "./signatureStateMachine-C-nUq_oq.esm.js";
+import { t as signatureMachine } from "./signatureStateMachine-_1c1vSid.esm.js";
 //#region src/modules/signature/signatureActor.ts
 function createSignatureActor(options) {
 	return createActor(signatureMachine, { input: { config: options.config } }).start();

package/dist/{signatureStateMachine-C-nUq_oq.esm.js → signatureStateMachine-_1c1vSid.esm.js}

@@ -1,4 +1,4 @@
-import { t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { t as api, u as endpoints } from "./api-BO8JA7Pf.esm.js";
 import { i as assign, t as setup } from "./xstate.esm-DSajW7CJ.esm.js";
 import { n as fromPromise } from "./xstate-actors.esm-8Gzepa_A.esm.js";
 //#region src/modules/signature/signatureServices.ts

package/dist/{stats-BEvexnKC.esm.js → stats-BpMz-hTP.esm.js}

@@ -1,4 +1,4 @@
-import { r as getToken, t as api, u as endpoints } from "./api-Cz90EHyu.esm.js";
+import { r as getToken, t as api, u as endpoints } from "./api-BO8JA7Pf.esm.js";
 //#region src/modules/stats/statsServices.ts
 const deviceStatsQueue = [];
 async function postDeviceStatsNow(stats) {

package/dist/stats.esm.js

@@ -1,2 +1,2 @@
-import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-BEvexnKC.esm.js";
+import { n as flushDeviceStatsQueue, r as resetDeviceStatsQueue, t as addDeviceStats } from "./stats-BpMz-hTP.esm.js";
 export { addDeviceStats, flushDeviceStatsQueue, resetDeviceStatsQueue };

package/dist/{tri-xzRLIIMN.esm.js → tri-BajQnjbf.esm.js}

@@ -1,3 +1,5 @@
+import { t as SDK_VERSION } from "./sdkVersion-C3_P-Qbq.esm.js";
+import { t as BrowserTimerProvider } from "./BrowserTimerProvider-BXhgNxLt.esm.js";
 import { t as BrowserLazyImportProvider } from "./BrowserLazyImportProvider-BhoA957O.esm.js";
 //#region ../infra/src/providers/browser/TransactionalRiskIntelligenceProvider.ts
 const LAZY_IMPORT_OPTIONS = {
@@ -6,7 +8,7 @@ const LAZY_IMPORT_OPTIONS = {
 	timeoutMs: 1e4,
 	disabledMessage: "TRI will be disabled for this session."
 };
-const importSdk = () => import("./tri.esm-BIjHhBJ2.esm.js");
+const importSdk = () => import("./tri.esm-CzTNi5Q_.esm.js");
 /**
 * Concrete implementation of {@link ITransactionalRiskIntelligenceCapability}.
 *
@@ -30,6 +32,7 @@ const importSdk = () => import("./tri.esm-BIjHhBJ2.esm.js");
 var TransactionalRiskIntelligenceProvider = class TransactionalRiskIntelligenceProvider {
 	constructor() {
 		this._isStarted = false;
+		this._isSetUp = false;
 		this._lazySdk = BrowserLazyImportProvider.getInstance().create(importSdk, LAZY_IMPORT_OPTIONS);
 	}
 	static getInstance() {
@@ -41,6 +44,12 @@ var TransactionalRiskIntelligenceProvider = class TransactionalRiskIntelligenceP
 	get isStarted() {
 		return this._isStarted;
 	}
+	get isSetUp() {
+		return this._isSetUp;
+	}
+	get pendingSetup() {
+		return this._pendingSetup;
+	}
 	/**
 	* Lazy-loads `@incodetech/tri-sdk` (shared lazy handle) and exchanges the
 	* organization API key for a short-lived SDK token via the module's
@@ -71,12 +80,22 @@ var TransactionalRiskIntelligenceProvider = class TransactionalRiskIntelligenceP
 	* also calls `start()` and returns `'started'` on success. `_isStarted` is
 	* updated to reflect the resulting state so that `isTRIStarted()` is
 	* accurate immediately after `setup()` returns.
+	*
+	* The call is {@link pendingSetup} until it settles.
 	*/
-	async setup(config) {
+	setup(config) {
+		const setup = this._setup(config).finally(() => {
+			if (this._pendingSetup === setup) this._pendingSetup = void 0;
+		});
+		this._pendingSetup = setup;
+		return setup;
+	}
+	async _setup(config) {
 		try {
 			const module = await this._lazySdk.load();
 			if (!module) return "init-failed";
 			const state = await module.default.setup(config);
+			this._isSetUp = true;
 			if (state === "started") this._isStarted = true;
 			return state;
 		} catch {
@@ -106,6 +125,7 @@ var TransactionalRiskIntelligenceProvider = class TransactionalRiskIntelligenceP
 	async reset() {
 		const state = await (this._getSdk()?.reset() ?? Promise.resolve("init-failed"));
 		this._isStarted = false;
+		this._isSetUp = false;
 		return state;
 	}
 	/**
@@ -122,12 +142,40 @@ var TransactionalRiskIntelligenceProvider = class TransactionalRiskIntelligenceP
 			return false;
 		}
 	}
+	/**
+	* TRI's fpSignals PID and DEVICE results. Resolves `null` before `setup()`
+	* and on any failure, so a caller can always fall back to its own runtime.
+	*/
+	async getFpSignals() {
+		try {
+			return await this._getSdk()?.getFpSignals() ?? null;
+		} catch {
+			return null;
+		}
+	}
+	/**
+	* Passes one signed result of the host's runtime to TRI, unchanged. Returns
+	* `false` before `setup()` and on any failure.
+	*/
+	addFpSignals(signals) {
+		try {
+			return this._getSdk()?.addFpSignals(signals) ?? false;
+		} catch {
+			return false;
+		}
+	}
 	_getSdk() {
 		return this._lazySdk.get()?.default ?? null;
 	}
 };
 //#endregion
 //#region src/integrations/tri/tri.ts
+const SDK_HOST = {
+	platform: "sdk2",
+	version: SDK_VERSION
+};
+const FP_SIGNALS_WAIT_MS = 5e3;
+let sdkOwnsTRI = false;
 /**
 * Returns the active TRI capability implementation.
 *
@@ -187,28 +235,103 @@ async function createTRISession(apiKey, options) {
 * ready (e.g. after a consent gate). Linking is skipped in that case since
 * TRI has not started.
 *
+* A TRI that is already set up, typically by the host through
+* `@incodetech/core/tri`, is reused instead, after any setup still in flight
+* finishes: `config` is ignored (with a `[TRI]` warning), the session is linked
+* to the running activity, and the result is `'started'`, or `'ready'` when it
+* is not running. The host keeps owning it, so `reset()` leaves it running.
+*
 * @param config  - TRI setup config (must include `token` and `apiURL`).
 * @param options - Optional session-linking hints (`sessionToken`).
 */
 async function initializeTRI(config, options = {}) {
 	const resolvedTriConfig = resolveTRIConfig(config);
 	if (!resolvedTriConfig) return "init-failed";
-	const state = await setupTRI(resolvedTriConfig);
+	const provider = getProvider();
+	while (provider.pendingSetup) await provider.pendingSetup;
+	if (provider.isSetUp) {
+		console.warn("[TRI] Already set up: reusing the running TRI. This tri config is ignored.");
+		if (isTRIStarted() && options.sessionToken) await linkSessionWithTRI(options.sessionToken);
+		return isTRIStarted() ? "started" : "ready";
+	}
+	sdkOwnsTRI = true;
+	const state = await setupTRI(options.fpSignalsFromSdk ? withoutFpSignals(resolvedTriConfig) : resolvedTriConfig);
 	if (isTRIStarted() && options.sessionToken) await linkSessionWithTRI(options.sessionToken);
 	return state;
 }
 /**
+* SDK 2 first: its runtime already collects the fingerprint, so TRI does not
+* load a second fpSignals module, and the SDK passes its own results to TRI
+* (`addTRIFpSignals`). The host's `layers` or `collectors` choice is kept.
+*/
+function withoutFpSignals(config) {
+	if (config.layers) return {
+		...config,
+		layers: {
+			...config.layers,
+			"device-fingerprinting": false
+		}
+	};
+	if (config.collectors) return {
+		...config,
+		collectors: {
+			...config.collectors,
+			fpsignals: { enabled: false }
+		}
+	};
+	return {
+		...config,
+		layers: {
+			session: true,
+			behavioral: true,
+			"device-fingerprinting": false
+		}
+	};
+}
+/**
+* TRI's fpSignals PID and DEVICE results, waiting at most
+* {@link FP_SIGNALS_WAIT_MS} for the module to finish. Resolves `null` when
+* TRI is not started, its `fpsignals` collector is off or failed (CSP, load
+* error), or the wait ran out. The strings are signed: pass them on unchanged.
+*/
+async function readTRIFpSignals() {
+	if (!isTRIStarted()) return null;
+	const timer = BrowserTimerProvider.getInstance();
+	let timeout;
+	const timedOut = new Promise((resolve) => {
+		timeout = timer.setTimeout(() => resolve(null), FP_SIGNALS_WAIT_MS);
+	});
+	try {
+		return await Promise.race([getProvider().getFpSignals(), timedOut]);
+	} finally {
+		if (timeout !== void 0) timer.clearTimeout(timeout);
+	}
+}
+/**
+* Passes one signed result of the SDK's runtime to TRI as an `fp_signals`
+* event, unchanged. Returns `false` when TRI is not started or runs its own
+* `fpsignals` collector.
+*/
+function addTRIFpSignals(signals) {
+	return getProvider().addFpSignals(signals);
+}
+/**
 * Calls the provider's `setup()` with the given config. This is the step that
 * lazy-loads `@incodetech/tri-sdk`, validates the config, and checks the
 * backend collection-status endpoint. When `config.autostart` is `true` (the
 * default), also calls `start()` internally and returns `'started'` on
 * success. Pass `autostart: false` to receive `'ready'` and start explicitly.
 *
+* TRI reports the SDK as its host: `{ platform: 'sdk2', version }`.
+*
 * @param config - Resolved TRI config (`token` and `apiURL` required).
 * @returns The resulting {@link TransactionalRiskIntelligenceState}.
 */
 async function setupTRI(config) {
-	return getProvider().setup(config);
+	return getProvider().setup({
+		...config,
+		host: SDK_HOST
+	});
 }
 /**
 * Begins behavioral data collection. Requires a prior successful `setupTRI()`
@@ -235,6 +358,18 @@ async function resetTRI() {
 	return getProvider().reset();
 }
 /**
+* The SDK's `reset()` step for TRI: resets TRI and discards the provider only
+* when `setup({ tri })` set TRI up. A TRI the host set up through
+* `@incodetech/core/tri` keeps its activity, and the next session still links
+* to it.
+*/
+function resetSdkOwnedTRI() {
+	if (!sdkOwnsTRI) return;
+	sdkOwnsTRI = false;
+	resetTRI();
+	resetTRIProviderInstance();
+}
+/**
 * Links the current Incode interview session to the active TRI activity.
 *
 * Returns `false` when the session token is missing or TRI has not been set up.
@@ -248,9 +383,8 @@ async function linkSessionWithTRI(sessionToken) {
 /**
 * @private This function is not used outside of this file.
 *
-* Validates and narrows a {@link TransactionalRiskIntelligenceSetupConfig}
-* into a {@link TransactionalRiskIntelligenceConfig} suitable for passing to
-* the provider's `setup()`.
+* Validates a {@link TransactionalRiskIntelligenceSetupConfig} before it is
+* passed to {@link setupTRI}.
 *
 * Returns `null` (with a `[TRI]` warning) when a required field is missing.
 * Returns `null` silently when `config` is `undefined` (intentional opt-out).
@@ -270,4 +404,4 @@ function resolveTRIConfig(config) {
 	return config;
 }
 //#endregion
-export { resetTRI as a, startTRI as c, linkSessionWithTRI as i, stopTRI as l, initializeTRI as n, resetTRIProviderInstance as o, isTRIStarted as r, setupTRI as s, createTRISession as t };
+export { linkSessionWithTRI as a, resetTRI as c, stopTRI as d, isTRIStarted as i, setupTRI as l, createTRISession as n, readTRIFpSignals as o, initializeTRI as r, resetSdkOwnedTRI as s, addTRIFpSignals as t, startTRI as u };

package/dist/tri.d.ts

@@ -1,2 +1,2 @@
-import { a as startTRI, i as setupTRI, n as isTRIStarted, o as stopTRI, r as resetTRI, s as TransactionalRiskIntelligenceSetupConfig, t as createTRISession } from "./index-BKOWUhxG.js";
+import { a as startTRI, i as setupTRI, n as isTRIStarted, o as stopTRI, r as resetTRI, s as TransactionalRiskIntelligenceSetupConfig, t as createTRISession } from "./index-DEfwds5y.js";
 export { type TransactionalRiskIntelligenceSetupConfig, createTRISession, isTRIStarted, resetTRI, setupTRI, startTRI, stopTRI };